How your data is used and protected by Serial.
Serial is designed to keep as much information on-device as possible, transmitting information only when needed. Serial does not send any personally or device-identifiable information to any servers.
When you use Serial to lookup information on a given serial number, the full serial number is never sent off of the device. Barcode scanning is done completely locally, and camera data is never uploaded anywhere. All calculations to determine manufacture information and operating system family are performed on-device.
To allow identification of the model name (such as iPhone X or Apple Watch Series 4), the last few digits of your serial number are sent directly to a server controlled by Apple. These digits are not personally-identifiable or even unique to your device, as they are shared by every device of that model (i.e. nearly every Space Grey iPhone X will have the same last few digits).
To allow the prediction of the shipping version of a provided serial number’s device, the inferred operating system family (e.g. iOS, tvOS, or watchOS), device model name, and date range of the week of manufacture are sent to a server operated by me. No other information is sent to the server, and even this bare minimum of information is not stored.